CVE-2026-89693: nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: check nfsd4acltoattr() return value in nfsd4create()
nfsd4create() stores the return value of nfsd4acltoattr() in status, but the switch(create->crtype) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE proceeds without the requested ACL.
Add an early exit check after nfsd4acltoattr(), matching the pattern already used in nfsd4setattr().
[ cel: prefer NFS4ERRBADTYPE over NFS4ERRATTRNOTSUPP ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In nfsd4_create(), add an early-exit check immediately after nfsd4_acl_to_attr() so that a nonzero return status is propagated instead of being overwritten by the switch(create->cr_type) block; follow the existing nfsd4_setattr() pattern and prefer NFS4ERR_BADTYPE over NFS4ERR_ATTRNOTSUPP.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An NFSv4 CREATE operation must include an ACL that causes nfsd4_acl_to_attr() to return an error. The vulnerable path then overwrites that error and may create the object without the requested ACL.
What is the practical impact of the error being discarded?
The CREATE operation can proceed despite failure to translate the requested ACL, leaving the newly created object without that ACL. This can result in permissions differing from those requested by the NFS client.
How can I identify potentially affected objects?
Review objects created through NFSv4 CREATE requests that specified ACLs, particularly where clients may have supplied ACLs unsupported by the server. The provided information does not describe a definitive audit log or on-system detection method.